> > How about this patch? It tries to solve this race without additional> > locking. If refcount is already zero, it will increment and decrement> > it. So be careful to only call grab_namespace() with vfsmount_lock> > held, otherwise it could race with itself. (vfsmount_lock is also> > needed in this case so that mnt->mnt_namespace, doesn't change, while> > grabbing the namespace)> > How about using cmpxchg?

How? If the count is nonzero, an incremented count must be stored.You can't do that atomically with cmpxchg.